Electronic control systems are increasingly utilized in vehicles. These control systems operate at least one actuator element of a vehicle on the basis of detected operating variables or on the basis of operating quantities derived from measured quantities. Such control systems are used to control the drive unit, the brake system or other functions. For example, in the context of so-called drive-by-wire systems or brake-by-wire systems, an actuator of the vehicle is driven or actuated on the basis of the detected driver command via an electronic control system. What is common to these control systems is that the detection of an operating quantity, which influences the basic function, is redundantly secured. Accordingly, in these systems, the position of the operator-controlled element (accelerator pedal, brake pedal), which is actuated by the driver, is detected by at least two measuring devices independently of each other. The same applies to systems (for the actual value detection) wherein the actuator is adjusted in the context of a control loop (for example, a positioning control) in accordance with a desired value derived from the driver command. The detection of the particular operating quantity is at least redundant and serves for fault detection, for example, in that the two detected measured quantities or the quantities derived therefrom are checked with respect to each other as to a pregiven tolerance range. A procedure of this kind is disclosed with respect to the example of a drive-by-wire system in U.S. Pat. No. 5,170,769.
In checks of this kind, an actual fault condition with subsequent emergency operation with a view to disturbance signals is only detected when the check has shown the result "implausible" over a specific time. The emergency function is therefore initiated relatively late. In this way, damage in the actuator can occur with this actuator being actuated as in normal operation notwithstanding a fault condition. This is primarily the case for the control of a throttle flap by means of an actuating motor where, for example, a dynamic driving to the mechanical stop with mechanical damage as the consequence can occur when, for example, there is a separation of the signal line.
U.S. Pat. No. 5,119,300 discloses sensors which output a base signal (for example, zero) in an operating state of a vehicle as well as in the case of a fault. With the occurrence of the base signal, a preliminary emergency function is initiated and thereafter a fault check is carried out. The emergency function, which is provided for the case of a fault, is only initiated when the fault condition has been determined.